Privacy Policy

Last updated 18 September 2026

DomainIntel.app is a domain lookup tool. You type a domain, we query public records about it, and we show you the answer. There are no accounts, no sign-up and no login, so there is no profile to build.

This page describes what actually happens in the code, not a general statement of intent.

What we collect

Domains you look up

The domain you submit and the results we gather are stored so that a repeat lookup can be served from cache rather than re-queried. A stored scan contains the domain and its public records. It is not linked to your IP address, a cookie, or any other identifier — the scan table has no column for one. Cached results are reused for 24 hours.

Your IP address

Your IP address is used to enforce rate limits so one visitor cannot exhaust the service. The counter lives in Redis, is keyed to the IP and the endpoint, and expires automatically after the rate-limit window (one hour). We do not store your IP alongside the domains you looked up.

If a request fails with an error, the IP, the endpoint and the error message are written to an error log so the fault can be diagnosed. Those rows are deleted automatically after seven days. The web server also keeps standard access logs, as essentially every web server does.

Cookies

One cookie, session_token. It exists solely to make cross-site request forgery protection work: it is a random value, it is HttpOnly, Secure and SameSite=Strict, and it expires after 24 hours. It is not used to identify you, track you, or link your visits together.

Analytics

The website uses Google Analytics 4 to count visits and see which pages get read. Google sets its own cookies and receives your IP address as part of that; their handling is governed by Google’s privacy policy. Analytics runs on the website only. It is not present in the browser extension, the command-line tool, the MCP server or the embeddable widget.

The browser extension

The DomainIntel browser extension is deliberately narrow, so this section is short.

  • It does nothing until you click it. There is no background script watching your browsing, no content script injected into pages, and no automatic lookup when you open a tab.
  • When you click it, it sends one thing: the hostname of the tab you are on (for example example.com). Not the full URL, not the path, not query parameters, not the page content.
  • It asks for one permission, activeTab, which gives it access to the current tab only at the moment you click, and only until you navigate away.
  • Results are cached in your own browser for six hours so repeated clicks on the same site do not re-query. That cache is local to your machine and is cleared when you close the browser.

The hostname you send arrives at our server as an ordinary lookup and is treated exactly as described above: cached by domain, not linked to you. We do not build a history of the sites you visit, and we could not reconstruct one from what is stored.

What we do not do

  • We do not sell, rent or share your data with third parties.
  • We do not serve advertising and there are no advertising trackers.
  • We do not create user accounts or profiles.
  • We do not collect names, email addresses, postal addresses or payment details.
  • We do not track you across other websites.

Third parties we query on your behalf

Producing a report means asking public sources about the domain you submitted. These requests come from our server, not from your browser, so the third party sees us rather than you: WHOIS and RDAP registries, public DNS resolvers, the domain’s own web server (for its TLS certificate and HTTP headers), crt.sh for certificate transparency records, and ipinfo.io for IP geolocation.

Data we hold about you, and how to remove it

Because there are no accounts, there is usually nothing tied to you to remove: rate-limit counters expire within the hour and error-log rows within seven days. If you believe a stored scan contains something that should not be public, or you want a specific record deleted, email privacy@domainintel.app and say which domain it concerns.

Note that a WHOIS record is a public registry record. If your personal details appear in one, they are published by the registry, not by us, and removing our copy will not remove theirs. Your registrar’s privacy or proxy service is what changes that.

Children

This is a developer tool and is not directed at children under 13. We do not knowingly collect information from them.

Changes

If this policy changes, the date at the top changes with it. Material changes to what the extension sends would also require a new extension release and a fresh permission review.

Contact

Questions about this policy: privacy@domainintel.app. More about who builds this is on the about page.